Yuta/Glove Stealer Scheduled Task Persistence via schtasks from AppData Payload

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects the creation of suspicious scheduled tasks by potentially malicious processes (e.g., winupdate.exe or processes running from AppData/.cache or Temp directories). The rule monitors for schtasks.exe usage that either targets specific persistence locations or creates tasks naming conventions (e.g., 'WindowsDefenderAgent') often associated with the Yuta/Glove Stealer malware family.